Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 43de9dfe authored by Alexey Dobriyan's avatar Alexey Dobriyan Committed by David S. Miller
Browse files

netfilter: ip6table_filter in netns for real 



One still needs to remove checks in nf_hook_slow() and nf_sockopt_find()
to test this, though.

Signed-off-by: default avatarAlexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b891c5a8

net/ipv6/netfilter/ip6table_filter.c

+22 −9
Original line number Original line Diff line number Diff line
@@ -61,13 +61,25 @@ static struct xt_table packet_filter = { 




/* The work comes in here from netfilter.c. */

/* The work comes in here from netfilter.c. */

static unsigned int

static unsigned int

ip6t_hook(unsigned int hook,

ip6t_local_in_hook(unsigned int hook,

		   struct sk_buff *skb,

		   struct sk_buff *skb,

		   const struct net_device *in,

		   const struct net_device *in,

		   const struct net_device *out,

		   const struct net_device *out,

		   int (*okfn)(struct sk_buff *))

		   int (*okfn)(struct sk_buff *))

{

{

	return ip6t_do_table(skb, hook, in, out, init_net.ipv6.ip6table_filter);

	return ip6t_do_table(skb, hook, in, out,

			     nf_local_in_net(in, out)->ipv6.ip6table_filter);

}



static unsigned int

ip6t_forward_hook(unsigned int hook,

		  struct sk_buff *skb,

		  const struct net_device *in,

		  const struct net_device *out,

		  int (*okfn)(struct sk_buff *))

{

	return ip6t_do_table(skb, hook, in, out,

			     nf_forward_net(in, out)->ipv6.ip6table_filter);

}

}





static unsigned int

static unsigned int
@@ -87,19 +99,20 @@ ip6t_local_out_hook(unsigned int hook, 
	}

	}

#endif

#endif





	return ip6t_do_table(skb, hook, in, out, init_net.ipv6.ip6table_filter);

	return ip6t_do_table(skb, hook, in, out,

			     nf_local_out_net(in, out)->ipv6.ip6table_filter);

}

}





static struct nf_hook_ops ip6t_ops[] __read_mostly = {

static struct nf_hook_ops ip6t_ops[] __read_mostly = {

	{

	{

		.hook		= ip6t_hook,

		.hook		= ip6t_local_in_hook,

		.owner		= THIS_MODULE,

		.owner		= THIS_MODULE,

		.pf		= PF_INET6,

		.pf		= PF_INET6,

		.hooknum	= NF_INET_LOCAL_IN,

		.hooknum	= NF_INET_LOCAL_IN,

		.priority	= NF_IP6_PRI_FILTER,

		.priority	= NF_IP6_PRI_FILTER,

	},

	},

	{

	{

		.hook		= ip6t_hook,

		.hook		= ip6t_forward_hook,

		.owner		= THIS_MODULE,

		.owner		= THIS_MODULE,

		.pf		= PF_INET6,

		.pf		= PF_INET6,

		.hooknum	= NF_INET_FORWARD,

		.hooknum	= NF_INET_FORWARD,